The vulnerability CVE-2026-1764 affects the GNOME localsearch (tracker-miners) MP3 Extractor on Red Hat Enterprise Linux 10. Specifically, a missing bounds check in the extract_performers_tags function when handling specially crafted MP3 files containing ID3v2.4 tags can cause a heap buffer overflow. This can lead to a denial of service condition by triggering reads of unmapped memory and potentially disclose information by reading visible heap data. The CVSS 3.1 base score is 5.6, indicating a medium severity with local attack vector, low complexity, requiring low privileges and user interaction, impacting confidentiality slightly and availability significantly. There is no vendor advisory content indicating a patch or remediation level, and no known exploits in the wild have been reported as of the publication date.

An attacker with local access and the ability to trick a user into opening a crafted MP3 file could cause a denial of service by triggering out-of-bounds reads leading to heap buffer overflow. Additionally, there is a potential for limited information disclosure from heap memory. The impact on confidentiality is low, while availability impact is high. Integrity is not affected.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-1764 for current remediation guidance. No official fix or temporary workaround is indicated in the provided data. Until a patch is available, avoid processing untrusted MP3 files with ID3v2.4 tags using the affected component.